The Acronis Threat Research Unit (TRU) identifies a new targeted operation using Farsi language content and malicious LNK files to target Iranian supporters and dissidents
Acronis, global leader in the cybersecurity and in the data protection, announces that the Acronis Threat Research Unit (TRU) has identified a new malware campaign, called CrescentHarvest, which appears designed to target supporters of the ongoing protests in Iran for the purposes of information theft and prolonged espionage activities.
Observed shortly after January 9, the campaign exploits recent geopolitical developments to trick victims into opening malicious .LNK files disguised as protest-related images or videos. The files are distributed alongside authentic multimedia content and a Farsi-language document featuring updates from “rebel cities of Iran.” The protest-friendly approach seems to serve to increase the credibility of the bait and attract Farsi-speaking Iranians looking for information.
Infection occurs via compressed archives containing seemingly legitimate media files along with two malicious .LNK files masquerading as benign content. Upon opening, an embedded script extracts a ZIP archive hidden in the file itself, deploys the payload, and sets up a persistence mechanism configured to fire when the system re-establishes the network connection. Only at the end of the execution is the actual multimedia content shown, so as to reduce the victim's suspicion and simulate behavior consistent with the open file.
The malware is distributed via a DLL sideloading technique that leverages a digitally signed Google executable. Once active, it operates both as a remote access trojan and as an information stealer, allowing the execution of commands remotely, the recording of keystrokes and the stealing of credentials, cookies and browsing history. The technical analysis also highlighted a specific module designed to extract and decipher browser encryption keys based on app-bound encryption mechanisms, allowing access to normally protected data.
The features observed also include the collection of data relating to Telegram Desktop, the enumeration of local user accounts and the verification of security products installed on the system, with the possibility of adapting the behavior of the malware based on the level of protection detected. Communications with the command and control server occur via HTTPS traffic in JSON format, leveraging legitimate system APIs to make the traffic less distinguishable from ordinary traffic.
The analyzed samples are connected to the servicelog-information.com domain, associated with the IP address 185.242.105.230. The infrastructure appears to have been recently registered and has not previously been linked to any known activities. There is no definitive evidence available to attribute the operation to a specific group. However, the analysis of methodology, characteristics of the code and operational methods shows elements consistent with campaigns in the past associated with actors aligned with Iran. The attribution therefore remains formulated in probabilistic terms.
While no conclusive telemetry data on actual targets is available, the presence of Farsi-language content and pro-protest narrative suggest possible targeting of Farsi-speaking Iranians supportive of the demonstrations, as well as activists, journalists, and members of the diaspora. Given the context of information blackout within the country, it is plausible that the campaign is aimed to a greater extent at individuals abroad looking for information.
The CrescentHarvest campaign is part of a consolidated model of cyberespionage operations that exploit geopolitical events to deliver targeted malware. The analysis also highlighted some elements of operational discontinuity, including command and control endpoints set up but not used and imperfections in the management of HTTP traffic identification. These aspects suggest an intermediate level of technical maturity or a campaign developed and deployed quickly to exploit a specific geopolitical window. The techniques observed confirm an adaptive approach oriented towards the systematic collection of information and persistence over time. In scenarios characterized by high political tension, content apparently consistent with the victim's beliefs can be used as a tool of compromise.
Acronis EDR/XDR solutions help detect and block this threat by intercepting the persistence techniques and exfiltration activities highlighted in the analysis.
